diff --git a/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service b/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service
index e5d70ea7..b58cc9a9 100644
--- a/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service
+++ b/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service
@@ -4,7 +4,8 @@ Description=Enforce PAES encrypted root fs for SEL guests
 # Ensure this runs before the handoff to the real root, if that's required:
 After=cryptsetup.target
 After=initrd-root-device.target
-Before=sysroot.mount
+After=sysroot.mount
+Before=initrd-switch-root.service
 
 # Initramfs requirement
 DefaultDependencies=no